Splunk® Enterprise

Data Model and Pivot Tutorial

Download manual as PDF

This documentation does not apply to the most recent version of Splunk. Click here for the latest version.
Download topic as PDF

Create a new data model

This topic shows you how to create new data models based on the tutorial data. Data models are created within Pivot and you need to have the admin or power role to create a data model.

Enable roles to create a data model

By default only users with the admin or power role can create data models. For other users, the ability to create a data model is tied to whether their roles have "write" access to an app. Since this is a first time install, you have admin privileges by default and should be able to continue.

If you are not able to create or edit a data model, you may need to check your permissions. For more information, read "About data model permissions" in the Knowledge Manager Manual.

Navigate to the Data Models management page

  1. In the Splunk bar, click Settings. 6.2tutorial settings datamodel.png

  2. Under Knowledge, click Data Models. 6.2tutorial datamodel manage.png This takes you to the Data Models management page. The Data Models management page is a listing page of data models. If you have existing data models in this Splunk Enterprise instance, this page lists them. Use this page to manage the permissions, acceleration, cloning, and removal of existing data models. You can also use this page to upload a data model or create new data models, using the Upload Data Model and New Data Model buttons on the top right.

Create a new data model

1. In the Data Models management page, click New Data Model.

This opens the New Data Model dialog box.

6.2tutorial datamodel new.png

2. Enter the Title, "Buttercup Games"

The Title field accepts any character, as well as spaces. The value you enter here is what appears on the data model listing pages.

3. (Optional) Enter the ID, "Tutorial"

If you don't change the ID, it automatically reads "Buttercup_Games".

The ID must be a unique identifier for the data model. It cannot contain spaces or any characters that aren't alphanumeric, underscores, or hyphens (a-z, A-Z, 0-9, _, or -). Spaces between characters are also not allowed. Once you define the data model ID, you can't change it.

4. Next to App, select "Search & Reporting" from the menu.

5. (Optional) Enter the Description, "Enables data analysis and reporting for tutorial data."

6. Click Create.

This opens the Buttercup Games data model page, where you can add datasets.

6.2tutorial datamodel editobjects.png

Use this page to create datasets for the new data model, define their constraints and attributes, arrange the datasets in logical hierarchies, and manage them.

Next steps

Continue to the next topic to add a root object to the Buttercup Games data model.

About data models and data model objects
Define a root object for the data model

This documentation applies to the following versions of Splunk® Enterprise: 6.2.0, 6.2.1, 6.2.2, 6.2.3, 6.2.4, 6.2.5, 6.2.6, 6.2.7, 6.2.8, 6.2.9, 6.2.10, 6.2.11, 6.2.12, 6.2.13, 6.2.14, 6.2.15, 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11


Hi @Kripsmk,

There was a terminology change in 6.5.0 from "data model objects" to "data model datasets". It seems that you might be on the wrong version of our documentation. You can change the version in the upper right side of the documentation page. If you are seeing "datasets" in your UI, select version 6.5.0.


Myu splunk, Splunker
October 10, 2016

the prob is resolved since i now have Splunk Enterprise. It is however going to Edit Datasets instead of Edit Objects. Stuck ?

October 10, 2016

I think I ve downloaded Splunk>Light version by mistake..... is it why that is happening ?

October 9, 2016

I cant see the Data Model option under the Knowledge section. I assumed that it might have to do with permissions even though I had logged in for the first time, but cant see that option too. The help says go to "Data Model Management Page" but that also cant be seen. Am stuck here now

October 9, 2016

Was this documentation topic helpful?

Enter your email address, and someone from the documentation team will respond to you:

Please provide your comments here. Ask a question or make a suggestion.

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters